Third-party service with authentication
I want to build a (for example) commenting API (maybe like Disqus) but I have a problem to solve.
I don't want to have a registration system on my side to sign up and sign in users for leaving a comment. They could comment by just signing in the host API and then sending a token to my API to recognize them as a user.
For example,
You have a website, and users sign up there. Then they want to submit a comment. You already implemented my API for comments as a Third-party service. You send user comment submission with a token to my API. So, I can verify the token and store comment with its owner for your site.
What's your solution for the token and the verification step? or any clue?
Hey Naser from a fellow -89:er! :)
How are you planning to "recognize them as a user" when you send the token?
Generally it sounds a bit too complex to have users on one remote system (your customer I presume) and all comments on your system.
I think the easiest and quickest solution is to let users send their information (name, avatar, profile url) with their comment. Then you'd save their information along side the comment.
The downside is that you can't confirm that the user is why they say they are. Anyone could send a comment as "Elon Musk" forexample.
If you want to confirm their identity you need a shared token between your system and the customers system.
Something like:
This would require custom implementation for your customers. I'm not sure you want that?
for example, Parse has a mechanism for implementing Third-party authentications.
https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
You need to send an id field to recognize the user with that and other parameters Third-party needs to authenticate that user.
This is the interface.
But the problem is that you have to implement every authenticator in CODE and it would not be useful when you want to support all authentication systems including unpopular ones!
Hi Johan,
89 is my birth year ;)
Imagine that only authenticated users can send comments. So, it doesn't matter what is their name or anything else. Just their unique id is important to recognize them as a user.
So, your client application sends me a token with the comment text. Then I have to verify that token by a mechanism! What's a GENERAL way to verify a string token that is easy for the client to provide?